3 ms·
Wildcard certs are (only?) issued from DNS-01 challenges. As long as the requester can satisfy the DNS challenge ACME doesn't care about key uniqueness.
by zrail 5y ago
Wildcard certs are (only?) issued from DNS-01 challenges. As long as the requester can satisfy the DNS challenge ACME doesn't care about key uniqueness.
- Spooky23 5y agoWith Digicert, you do a different API call “duplicate certificate” to avoid buying another cert unnecessarily. I would consider it to be a best practice to keep unique keys as an SOP as it discourages bad behaviors, like keeping private keys accessible on file servers or even mail.
- dsr_ 5y agoRight. If you control the DNS, you can point names at any IP address and get appropriate certs for them. Therefore, you must protect your DNS infrastructure.
- Hamuko 5y agoIsn't the need to protect your DNS infrastructure pretty obvious anyways even when ignoring certificate validation?
- rocqua 5y agoBesides, if I can change your DNS, I can change your HTTP responses as well. So control over DNS already lets me get a lets-encrypt cert for you anyway. Though it is slightly easier to notice if someone changes your DNS to point to a different server than if someone adds a TXT record. I say slightly because if I change your DNS to point at my server I can just proxy requests to your old server so everything still looks like it works. Heck, even with most other certificate issuers I can get a cert in similar ways when controlling DNS.
- egberts1 5y agoHow often do one monitor their zone files and its updates? Would you be able to catch new subdomains being created under your watch?
- fomine3 5y agoObvious, but tend to be missed on small deployments.